EUVD-2026-77175
GHSA-gx4x-gc82-v87q
Severity by source
AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Service binds to all interfaces (AV:A), no auth or complexity (AC:L/PR:N), MCP tools in a coding assistant likely enable file and shell access affecting the host (S:C, C:H, I:H).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
In Oraios AI Serena before 1.0.0, the listen address of the MCP server in HTTP mode is 0.0.0.0. NOTE: the Supplier observed that 0.0.0.0 was a "potential security hazard" but the Serena documentation, at the time of the issue report proposing 127.0.0.1 instead of 0.0.0.0, recommended "use a sandboxed environment for running Serena."
AnalysisAI
Serena, an AI coding assistant built on the Model Context Protocol (MCP), exposed its HTTP-mode server on all network interfaces (0.0.0.0) by default in versions before 1.0.0, allowing any host reachable on the same network to connect to the unauthenticated MCP endpoint. The MCP protocol is a tool-execution channel for LLM agents; in a coding assistant context, those tools routinely include file system access and potentially shell invocation, making the true blast radius of unrestricted access substantially higher than the NVD CVSS of 2.9 suggests. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The vulnerability is present when Serena is launched in HTTP mode (the non-stdio transport) without explicitly passing '--host 127.0.0.1'. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS of 2.9 (AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) is difficult to reconcile with the mechanics of the issue: a service binding to 0.0.0.0 is reachable over the network, yet AV:L (local access required) implies physical or logon access, and AC:H (high complexity) implies a race or unusual prerequisite - neither of which applies to simply connecting to an open TCP port. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: version 1.0.0, which changes the default listen host to '127.0.0.1' in both src/serena/cli.py and src/serena/mcp.py. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in the Oraios Serena MCP coding toolkit (prior to v1.5.2) lets a malicious webpage hijack a develo
Cross-site request forgery (CSRF) vulnerability in the web client in Serena Dimensions CM 12.2 build 7.199.0 allows remo
Multiple cross-site scripting (XSS) vulnerabilities in the web client in Serena Dimensions CM 12.2 build 7.199.0 allow r
Share
External POC / Exploit Code
Leaving vuln.today